Create new events from search results

[Tim]

Hi,

How can I use a search result to create a new set of events (with a new sourcetype)? I'd like to schedule a report to perform analysis on some data and transform those results into an entirely new data set.

So far, I've only identified ways to append fields to an existing event. Is it possible to create entirely new events using the search language?

Thanks, Tim

[jkomarek]

Only way which I have found so far is to use DB connect and create db output to database table as a middle man and then dbinput to take them back into splunk.
It is an ugly workaround, but it seems to be working.

[Lowell]

You may want to take a look at lookups. This is a very helpful way to augment data to your events. See the following page from the docs:

• Use field lookups to add information to your events

If you want to add fields to a specific event, that's more difficult to accomplish, but it can be done using lookups. Take a look at this answer:

• Correlate (and tag!) Splunk events with Change Control Tickets

You would have to modify your application of this solution slightly, but the core idea is the same.

[sideview]

If you mean that you'd like to take some transformed results and re-index them as though they were events, you're looking for 'summary indexing'.

http://www.splunk.com/base/Documentation/latest/Knowledge/Usesummaryindexing?r=searchtip

However Im not sure that it is what you're looking for. I think you might just be looking to learn more about the search language itself.

Lets say that <your search> matches a bunch of events, each event has a 'user' and a 'bytes' field, and you want to end up with rows that are individual users, you would just do something like:

<your search> | stats sum(bytes) by userid

or

<your search> | timechart sum(bytes) by userid

and I could go on describing common search language operators but we'd be here for hours. http://www.splunk.com/base/Documentation/latest/SearchReference/Stats